[9.0] [Security Solution][Detection Engine] fixes ES|QL cypress tests (#213553) (#214363)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[Security Solution][Detection Engine] fixes ES|QL cypress tests
(#213553)](https://github.com/elastic/kibana/pull/213553)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Vitalii
Dmyterko","email":"92328789+vitaliidm@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-03-13T12:40:38Z","message":"[Security
Solution][Detection Engine] fixes ES|QL cypress tests (#213553)\n\n##
Summary\n\n - addresses:\n -
https://github.com/elastic/kibana/issues/184558\n -
https://github.com/elastic/kibana/issues/184557\n -
https://github.com/elastic/kibana/issues/184556\n\nbfetch was disabled
for Kibana, so I removed spying for this request for\nES|QL Cypress
tests\n\n\n✅ [Security Solution Detection Engine
-\nCypress](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7999):\n100/100
tests passed.\n\n\n✅ [[Serverless] Security Solution Detection Engine
-\nCypress](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8000):\n100/100
tests
passed.","sha":"ee8f9676c7e134ce8a1368dc684cc66d22a2b5c8","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Detections
and Resp","Team:Detection
Engine","backport:version","v8.18.0","v9.1.0","v8.19.0"],"title":"[Security
Solution][Detection Engine] fixes ES|QL cypress
tests","number":213553,"url":"https://github.com/elastic/kibana/pull/213553","mergeCommit":{"message":"[Security
Solution][Detection Engine] fixes ES|QL cypress tests (#213553)\n\n##
Summary\n\n - addresses:\n -
https://github.com/elastic/kibana/issues/184558\n -
https://github.com/elastic/kibana/issues/184557\n -
https://github.com/elastic/kibana/issues/184556\n\nbfetch was disabled
for Kibana, so I removed spying for this request for\nES|QL Cypress
tests\n\n\n✅ [Security Solution Detection Engine
-\nCypress](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7999):\n100/100
tests passed.\n\n\n✅ [[Serverless] Security Solution Detection Engine
-\nCypress](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8000):\n100/100
tests
passed.","sha":"ee8f9676c7e134ce8a1368dc684cc66d22a2b5c8"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.18","8.x"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/213553","number":213553,"mergeCommit":{"message":"[Security
Solution][Detection Engine] fixes ES|QL cypress tests (#213553)\n\n##
Summary\n\n - addresses:\n -
https://github.com/elastic/kibana/issues/184558\n -
https://github.com/elastic/kibana/issues/184557\n -
https://github.com/elastic/kibana/issues/184556\n\nbfetch was disabled
for Kibana, so I removed spying for this request for\nES|QL Cypress
tests\n\n\n✅ [Security Solution Detection Engine
-\nCypress](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7999):\n100/100
tests passed.\n\n\n✅ [[Serverless] Security Solution Detection Engine
-\nCypress](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8000):\n100/100
tests
passed.","sha":"ee8f9676c7e134ce8a1368dc684cc66d22a2b5c8"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Vitalii Dmyterko <92328789+vitaliidm@users.noreply.github.com>

x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/esql_rule.cy.ts

@@ -67,8 +67,7 @@ const workaroundForResizeObserver = () =>
     }
   });
 
-// Failing: See https://github.com/elastic/kibana/issues/184558
-describe.skip(
+describe(
   'Detection ES|QL rules, creation',
   {
     tags: ['@ess', '@serverless', '@skipInServerlessMKI'],

x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_edit/esql_rule.cy.ts

@@ -55,10 +55,7 @@ const rule = getEsqlRule();
 const expectedValidEsqlQuery =
   'from auditbeat* | stats _count=count(event.category) by event.category';
 
-// Skipping in MKI due to flake
-// Failing: See https://github.com/elastic/kibana/issues/184557
-// Failing: See https://github.com/elastic/kibana/issues/184556
-describe.skip(
+describe(
   'Detection ES|QL rules, edit',
   {
     tags: ['@ess', '@serverless', '@skipInServerlessMKI'],

x-pack/test/security_solution_cypress/cypress/tasks/create_new_rule.ts

@@ -978,27 +978,17 @@ export const openSuppressionFieldsTooltipAndCheckLicense = () => {
 };
 
 /**
- * intercepts /internal/bsearch request that contains esqlQuery and adds alias to it
+ * intercepts esql_async request that contains esqlQuery and adds alias to it
  */
 export const interceptEsqlQueryFieldsRequest = (
   esqlQuery: string,
   alias: string = 'esqlQueryFields'
 ) => {
-  const isServerless = Cypress.env('IS_SERVERLESS');
-  // bfetch is disabled in serverless, so we need to watch another request
-  if (isServerless) {
-    cy.intercept('POST', '/internal/search/esql_async', (req) => {
-      if (req.body?.params?.query?.includes?.(esqlQuery)) {
-        req.alias = alias;
-      }
-    });
-  } else {
-    cy.intercept('POST', '/internal/search?*', (req) => {
-      if (req.body?.batch?.[0]?.request?.params?.query?.includes?.(esqlQuery)) {
-        req.alias = alias;
-      }
-    });
-  }
+  cy.intercept('POST', '/internal/search/esql_async', (req) => {
+    if (req.body?.params?.query?.includes?.(esqlQuery)) {
+      req.alias = alias;
+    }
+  });
 };
 
 export const checkLoadQueryDynamically = () => {